ambit-ts 0.1.0

package/dist/core/approvals.d.ts

@@ -0,0 +1,82 @@
+/**
+ * The approval ledger: reading `ambit.approvals.md` and deciding which
+ * authority increases it lets through (DESIGN.md §6.3).
+ *
+ * Pure, like `authority-diff.ts` beside it. Text in, decisions out — nothing
+ * here opens a file or runs git, so the whole rule that governs whether a
+ * pull request passes can be unit tested without a repository.
+ */
+import type { AuthorityRef } from "./authority.ts";
+import type { AuthorityDiff, SymbolAuthorityDiff } from "./authority-diff.ts";
+import type { SymbolId } from "./symbol-id.ts";
+/** One parsed approval line. */
+export interface Approval {
+    readonly symbol: SymbolId;
+    readonly authority: AuthorityRef;
+    /** Why the increase was accepted. Free text, required — an approval with no reason records nothing. */
+    readonly reason: string;
+    /** 1-based line in the ledger, so a report can point at it. */
+    readonly line: number;
+}
+/** A `-` line that is not an approval. Reported, and grants nothing. */
+export interface MalformedApprovalLine {
+    readonly line: number;
+    readonly text: string;
+}
+export interface ParsedApprovals {
+    readonly approvals: readonly Approval[];
+    readonly malformed: readonly MalformedApprovalLine[];
+}
+/** The file name looked for, beside `ambit.config.ts` and found the same way (§6.3). */
+export declare const APPROVALS_FILENAME = "ambit.approvals.md";
+/**
+ * Read a ledger.
+ *
+ * Approvals are the lines whose first non-space character is `-`, below the
+ * `Approvals` heading; everything else is prose, so the file explains itself
+ * to the person reading the pull request — and can use a bullet list to do it,
+ * which is why the heading is needed at all. A file with no such heading is
+ * read as approvals throughout, so a ledger that is nothing but lines works.
+ *
+ * A `-` line inside the region that does not parse is *not* silently demoted
+ * to prose — that would turn a typo in an approval into an approval that does
+ * nothing and says nothing (DESIGN.md §3.4) — it is returned as malformed.
+ */
+export declare function parseApprovals(text: string): ParsedApprovals;
+/** The line to add to the ledger for one increase — what `ambit diff` prints to be copied. */
+export declare function formatApprovalLine(symbol: SymbolId, ref: AuthorityRef, reason?: string): string;
+/** One authority one symbol gained — the unit an approval line is written for. */
+export interface IncreaseItem {
+    readonly entry: SymbolAuthorityDiff;
+    readonly ref: AuthorityRef;
+}
+export interface ApprovedIncrease extends IncreaseItem {
+    readonly approval: Approval;
+}
+export interface ApprovalReview {
+    /** Increases carrying an approval added in this comparison. Reported; not a failure. */
+    readonly approved: readonly ApprovedIncrease[];
+    /** Increases with nothing to approve them. This is what fails a check. */
+    readonly unapproved: readonly IncreaseItem[];
+    /**
+     * Approvals added in this comparison that matched no increase — a mistyped
+     * symbol id or authority, most often. Reported, never a failure on its own:
+     * whatever the line was meant to approve is still unapproved, and that is
+     * what fails.
+     */
+    readonly unused: readonly Approval[];
+}
+/**
+ * Decide, for every increase in `diff`, whether the ledger approves it.
+ *
+ * An approval is in force only in the comparison that adds it: the count of
+ * approvals for a `(symbol, authority)` pair is the head side's count minus
+ * the base side's, and the *last* that many head-side lines are the ones that
+ * count. So a line already merged grants nothing, re-approving a pair later is
+ * appending a second identical line, and deleting a line can only ever lower
+ * what is approved (DESIGN.md §6.3).
+ *
+ * Both sides' lines are read from the same ledger file, one in the working
+ * tree and one in the base checkout.
+ */
+export declare function reviewIncreases(diff: AuthorityDiff, base: readonly Approval[], head: readonly Approval[]): ApprovalReview;

package/dist/core/authority-diff.d.ts

@@ -0,0 +1,98 @@
+import type { AuthorityPath, AuthorityRecord, AuthorityRef } from "./authority.ts";
+import type { SymbolId } from "./symbol-id.ts";
+/**
+ * Whether a symbol exists on both sides of the comparison, only on the new
+ * side, only on the old one, or on both under different paths.
+ *
+ * A symbol id contains the file path (DESIGN.md §5.3), so a function whose
+ * file moved would be a `"deleted"` and a `"new"` symbol. `"moved"` is that
+ * pair recombined, and only ever on evidence git supplied: the caller passes
+ * the renames git reported, and nothing here guesses at identity beyond them.
+ * A guess would put a fabricated "unchanged" in front of a reader whose
+ * function may in fact have gained authority on the way (DESIGN.md §6.3).
+ */
+export type SymbolStatus = "present" | "new" | "deleted" | "moved";
+/** What changed about one symbol's authority between two dumps. */
+export interface SymbolAuthorityDiff {
+    readonly symbol: SymbolId;
+    readonly status: SymbolStatus;
+    /** For a `"moved"` symbol, the id it had on the base side. Absent otherwise. */
+    readonly movedFrom?: SymbolId;
+    /** Authority the new side has that the old side did not grant. */
+    readonly added: readonly AuthorityRef[];
+    /** Authority the old side had that the new side does not. */
+    readonly removed: readonly AuthorityRef[];
+    readonly unchanged: readonly AuthorityRef[];
+    /**
+     * The analysis reached something it could not resolve on the new side but
+     * not on the old one — the opposite for `unknownLost`.
+     *
+     * Reported, never counted as an increase: `unknown` is not authority
+     * (DESIGN.md §4.3). Reported all the same, because a range that stopped
+     * being analyzable must not come out as "nothing increased here".
+     */
+    readonly unknownGained: boolean;
+    readonly unknownLost: boolean;
+    /** The new side's record, for rendering the path of an increase. Absent for a deleted symbol. */
+    readonly head?: AuthorityRecord;
+    /** The old side's record. Absent for a new symbol. */
+    readonly base?: AuthorityRecord;
+}
+export interface AuthorityDiff {
+    /** Every symbol either side knows about, sorted by symbol id. */
+    readonly symbols: readonly SymbolAuthorityDiff[];
+}
+/**
+ * Files git reported as renamed between the two sides, base path to head
+ * path, each relative to the checked directory and separated by `"/"`.
+ *
+ * Supplied by the caller because this module runs no git (see
+ * {@link diffAuthority}); `ambit diff` reads it from
+ * `git diff --find-renames`.
+ */
+export type RenamedFiles = ReadonlyMap<string, string>;
+/**
+ * Compare two authority dumps (DESIGN.md §5.1's `kind: "authority"` records).
+ *
+ * Pure: two arrays in, one result out. It never reads a file, runs git, or
+ * asks a backend anything, which is what lets the whole comparison be unit
+ * tested without a repository — `ambit diff` is only the part that produces
+ * the two arrays.
+ *
+ * What is compared is *effective* authority (see `effectiveEffects`): what a
+ * function declares, or what its body was inferred to do when it declares
+ * nothing. Widening a tag therefore reads as an increase even though the body
+ * did not move, which is the case this comparison exists for.
+ */
+export declare function diffAuthority(base: readonly AuthorityRecord[], head: readonly AuthorityRecord[], renames?: RenamedFiles): AuthorityDiff;
+/**
+ * Symbols whose authority grew, and new symbols that hold any — the increases
+ * an approval is written for (DESIGN.md §6.3).
+ *
+ * A symbol that only moved is not here: it is compared against its own base
+ * record, so `added` is empty unless the move also widened something, and then
+ * only the widening is reported.
+ */
+export declare function authorityIncreases(diff: AuthorityDiff): readonly SymbolAuthorityDiff[];
+/** Symbols that lost authority without disappearing. Reported; never a failure. */
+export declare function authorityDecreases(diff: AuthorityDiff): readonly SymbolAuthorityDiff[];
+/** Symbols carried across a file git reported as renamed. Reported; never a failure on its own. */
+export declare function movedSymbols(diff: AuthorityDiff): readonly SymbolAuthorityDiff[];
+/** Symbols the new side no longer has. Reported; never a failure. */
+export declare function deletedSymbols(diff: AuthorityDiff): readonly SymbolAuthorityDiff[];
+/** Symbols present on both sides whose authority is exactly the same. */
+export declare function unchangedSymbols(diff: AuthorityDiff): readonly SymbolAuthorityDiff[];
+/**
+ * Symbols whose analysis went from resolved to unresolved. Not an increase —
+ * `unknown` is not authority — but never silence either: a range that stopped
+ * being analyzable is exactly what must not be reported as "not increased".
+ */
+export declare function unknownGained(diff: AuthorityDiff): readonly SymbolAuthorityDiff[];
+export declare function hasAuthorityIncrease(diff: AuthorityDiff): boolean;
+/**
+ * The call path a record carries for one authority, if it carries one.
+ *
+ * Absent when the function declares an authority its body does not reach:
+ * there is no path to show and none is invented (DESIGN.md §5.3).
+ */
+export declare function pathFor(record: AuthorityRecord | undefined, ref: AuthorityRef): AuthorityPath | undefined;

package/dist/core/authority-diff.js

@@ -0,0 +1,209 @@
+import { capabilityRef, effectiveCapabilities, effectiveEffects, effectRef, formatAuthorityRef, holdsAuthority, } from "./authority.js";
+import { capabilityCovers, parseCapability } from "./capability.js";
+/**
+ * Compare two authority dumps (DESIGN.md §5.1's `kind: "authority"` records).
+ *
+ * Pure: two arrays in, one result out. It never reads a file, runs git, or
+ * asks a backend anything, which is what lets the whole comparison be unit
+ * tested without a repository — `ambit diff` is only the part that produces
+ * the two arrays.
+ *
+ * What is compared is *effective* authority (see `effectiveEffects`): what a
+ * function declares, or what its body was inferred to do when it declares
+ * nothing. Widening a tag therefore reads as an increase even though the body
+ * did not move, which is the case this comparison exists for.
+ */
+export function diffAuthority(base, head, renames = new Map()) {
+    const rebased = rebaseRenamed(base, renames);
+    const baseById = indexBySymbol(rebased.records, "base");
+    const headById = indexBySymbol(head, "head");
+    const symbols = [...new Set([...baseById.keys(), ...headById.keys()])]
+        .toSorted()
+        .map((symbol) => compareSymbol(symbol, baseById.get(symbol), headById.get(symbol), rebased.movedFrom.get(symbol)));
+    return { symbols };
+}
+/**
+ * Re-express the base side's symbol ids under the head side's paths, for the
+ * files git reported as renamed.
+ *
+ * This is the whole of move handling: once `old.ts#f` is called `new.ts#f`,
+ * the ordinary comparison does the rest, and a move that also widened a
+ * contract still reports exactly the widening. A remap that would collide
+ * with an id the base side already has is dropped rather than resolved —
+ * git cannot report a rename onto a path that existed on the base side, so
+ * this is unreachable, and guessing which of the two records wins is the one
+ * answer that could hide an increase.
+ */
+function rebaseRenamed(base, renames) {
+    if (renames.size === 0)
+        return { records: base, movedFrom: new Map() };
+    const existing = new Set(base.map((record) => record.symbol));
+    const movedFrom = new Map();
+    const records = base.map((record) => {
+        const hash = record.symbol.indexOf("#");
+        if (hash < 0)
+            return record;
+        const renamed = renames.get(record.symbol.slice(0, hash));
+        if (renamed === undefined)
+            return record;
+        const moved = `${renamed}${record.symbol.slice(hash)}`;
+        if (existing.has(moved) || movedFrom.has(moved))
+            return record;
+        movedFrom.set(moved, record.symbol);
+        return { ...record, symbol: moved };
+    });
+    return { records, movedFrom };
+}
+function indexBySymbol(records, side) {
+    const byId = new Map();
+    for (const record of records) {
+        // Two records for one id would make the comparison silently depend on
+        // input order. The backend contract already forbids it
+        // (test/backend.conformance.test.ts), so this is a broken input, not a
+        // case to paper over with last-write-wins.
+        if (byId.has(record.symbol)) {
+            throw new Error(`duplicate authority record for ${record.symbol} on the ${side} side`);
+        }
+        byId.set(record.symbol, record);
+    }
+    return byId;
+}
+function compareSymbol(symbol, base, head, movedFrom) {
+    if (head === undefined) {
+        if (base === undefined)
+            throw new Error(`no record for ${symbol} on either side`);
+        return {
+            symbol,
+            status: "deleted",
+            added: [],
+            removed: authorityOf(base),
+            unchanged: [],
+            unknownGained: false,
+            unknownLost: isUnknown(base),
+            base,
+        };
+    }
+    if (base === undefined) {
+        return {
+            symbol,
+            status: "new",
+            added: authorityOf(head),
+            removed: [],
+            unchanged: [],
+            unknownGained: isUnknown(head),
+            unknownLost: false,
+            head,
+        };
+    }
+    const addedEffects = missingEffects(effectiveEffects(base), effectiveEffects(head));
+    const removedEffects = missingEffects(effectiveEffects(head), effectiveEffects(base));
+    const addedCapabilities = uncoveredCapabilities(effectiveCapabilities(base), effectiveCapabilities(head));
+    const removedCapabilities = uncoveredCapabilities(effectiveCapabilities(head), effectiveCapabilities(base));
+    const added = [...addedEffects.map(effectRef), ...addedCapabilities.map(capabilityRef)];
+    const removed = [...removedEffects.map(effectRef), ...removedCapabilities.map(capabilityRef)];
+    const addedNames = new Set(added.map(formatAuthorityRef));
+    const unchanged = authorityOf(head).filter((ref) => !addedNames.has(formatAuthorityRef(ref)));
+    return {
+        symbol,
+        status: movedFrom === undefined ? "present" : "moved",
+        ...(movedFrom === undefined ? {} : { movedFrom }),
+        added,
+        removed,
+        unchanged,
+        unknownGained: isUnknown(head) && !isUnknown(base),
+        unknownLost: isUnknown(base) && !isUnknown(head),
+        head,
+        base,
+    };
+}
+function authorityOf(record) {
+    return [
+        ...effectiveEffects(record).map(effectRef),
+        ...effectiveCapabilities(record).map((capability) => capabilityRef(capability)),
+    ];
+}
+function isUnknown(record) {
+    return record.effects.unknown || record.capabilities.unknown;
+}
+/** Effects in `candidate` that `reference` does not contain. Plain set difference. */
+function missingEffects(reference, candidate) {
+    const have = new Set(reference);
+    return candidate.filter((effect) => !have.has(effect));
+}
+/**
+ * Capabilities in `candidate` that nothing in `reference` permits.
+ *
+ * Containment, not string equality, because `<resource>:<action>:<target>`
+ * has a glob in `target` (DESIGN.md §4.4) and the same rule that governs
+ * caller-to-callee narrowing governs this comparison. Narrowing
+ * `http:get:*` to `http:get:api.example.com` is therefore not an increase,
+ * while widening it back is: nothing in `[api.example.com]` covers `*`.
+ *
+ * A token neither side can parse falls back to exact text. It came from a
+ * dump this codebase wrote, so this is unreachable in practice; treating an
+ * unparseable token as covered would be the one wrong answer, since it would
+ * hide an increase.
+ */
+function uncoveredCapabilities(reference, candidate) {
+    const grants = reference.map((text) => ({ text, parsed: parseCapability(text) }));
+    return candidate.filter((text) => {
+        const required = parseCapability(text);
+        return !grants.some((grant) => grant.parsed && required ? capabilityCovers(grant.parsed, required) : grant.text === text);
+    });
+}
+/**
+ * Present under the same id on both sides, or under a renamed path — the two
+ * statuses whose `added` / `removed` are a real comparison rather than the
+ * whole of one side's authority.
+ */
+function comparable(entry) {
+    return entry.status === "present" || entry.status === "moved";
+}
+/**
+ * Symbols whose authority grew, and new symbols that hold any — the increases
+ * an approval is written for (DESIGN.md §6.3).
+ *
+ * A symbol that only moved is not here: it is compared against its own base
+ * record, so `added` is empty unless the move also widened something, and then
+ * only the widening is reported.
+ */
+export function authorityIncreases(diff) {
+    return diff.symbols.filter((entry) => (comparable(entry) && entry.added.length > 0) ||
+        (entry.status === "new" && entry.head !== undefined && holdsAuthority(entry.head)));
+}
+/** Symbols that lost authority without disappearing. Reported; never a failure. */
+export function authorityDecreases(diff) {
+    return diff.symbols.filter((entry) => comparable(entry) && entry.removed.length > 0);
+}
+/** Symbols carried across a file git reported as renamed. Reported; never a failure on its own. */
+export function movedSymbols(diff) {
+    return diff.symbols.filter((entry) => entry.status === "moved");
+}
+/** Symbols the new side no longer has. Reported; never a failure. */
+export function deletedSymbols(diff) {
+    return diff.symbols.filter((entry) => entry.status === "deleted");
+}
+/** Symbols present on both sides whose authority is exactly the same. */
+export function unchangedSymbols(diff) {
+    return diff.symbols.filter((entry) => comparable(entry) && entry.added.length === 0 && entry.removed.length === 0);
+}
+/**
+ * Symbols whose analysis went from resolved to unresolved. Not an increase —
+ * `unknown` is not authority — but never silence either: a range that stopped
+ * being analyzable is exactly what must not be reported as "not increased".
+ */
+export function unknownGained(diff) {
+    return diff.symbols.filter((entry) => entry.unknownGained);
+}
+export function hasAuthorityIncrease(diff) {
+    return authorityIncreases(diff).length > 0;
+}
+/**
+ * The call path a record carries for one authority, if it carries one.
+ *
+ * Absent when the function declares an authority its body does not reach:
+ * there is no path to show and none is invented (DESIGN.md §5.3).
+ */
+export function pathFor(record, ref) {
+    return record?.paths.find((path) => path.kind === ref.kind && path.authority === ref.name);
+}

package/dist/core/authority.d.ts

@@ -0,0 +1,109 @@
+import { type Capability } from "./capability.ts";
+import type { ContractOperation, ContractViaEntry } from "./diagnostic.ts";
+import type { KnownEffect } from "./effects.ts";
+import type { SourceLocation } from "./location.ts";
+import type { SymbolId } from "./symbol-id.ts";
+/**
+ * One function's authority, as `ambit check --format json` emits it
+ * (DESIGN.md §5.1's `kind: "authority"` record) and as `ambit diff` compares
+ * it.
+ *
+ * "Authority" here is what a function may act with, not what a diagnostic
+ * says about it: a record is emitted for every analyzed function, including
+ * the ones nothing is wrong with. It is a checker-side artifact — nothing at
+ * runtime reads it, so ADR-0005's objection to shipping contract data to the
+ * runtime does not apply.
+ *
+ * Both halves of each contract are carried, and neither is derived from the
+ * other, because they answer different questions: `declared` is what the
+ * source claims, `observed` / `required` is what the body was inferred to
+ * do. {@link effectiveEffects} states which one a comparison uses.
+ */
+export interface AuthorityRecord {
+    readonly kind: "authority";
+    readonly symbol: SymbolId;
+    readonly location: SourceLocation;
+    /** `@entrypoint` (DESIGN.md §4.1): where the runtime establishes a context. */
+    readonly entrypoint: boolean;
+    readonly effects: AuthorityEffects;
+    readonly capabilities: AuthorityCapabilities;
+    /**
+     * For an authority this function actually reaches, the call path that
+     * carries it — the same hops `--format github` folds into an annotation
+     * (§5.1). `ambit diff` renders the path of an *increase* from here, so the
+     * reader sees what introduced it without re-running the check.
+     *
+     * Only authority with a witness appears. An effect a function declares but
+     * whose body does not reach has no path, and none is synthesized (§5.3).
+     */
+    readonly paths: readonly AuthorityPath[];
+}
+/**
+ * `declared` is `null` when no `@effects` tag was written, and also when one
+ * was written but did not parse (`AMB-E002`): a declaration that does not
+ * mean what it says must not read as a narrower one than the author intended,
+ * which is how every other consumer treats `{ kind: "invalid" }`.
+ *
+ * `pure` never appears here; it is the empty list (DESIGN.md §4.2). The two
+ * are distinguishable because `declared: []` is a declared empty set while
+ * `declared: null` is no declaration at all.
+ */
+export interface AuthorityEffects {
+    readonly declared: readonly KnownEffect[] | null;
+    readonly observed: readonly KnownEffect[];
+    /** Propagation reached a call it could not resolve, so `observed` may be incomplete. */
+    readonly unknown: boolean;
+}
+/** The capability half, in the same shape. Capabilities are `<resource>:<action>:<target>` text. */
+export interface AuthorityCapabilities {
+    readonly declared: readonly string[] | null;
+    readonly required: readonly string[];
+    readonly unknown: boolean;
+}
+/** Which lattice an authority token belongs to — the two do not share a namespace. */
+export type AuthorityKind = "effect" | "capability";
+/** The call path that brings one authority into one function. */
+export interface AuthorityPath {
+    readonly authority: string;
+    readonly kind: AuthorityKind;
+    readonly via: readonly ContractViaEntry[];
+    /** The operation's own call site, when one is known. Absent, never guessed (§5.3). */
+    readonly operation?: ContractOperation;
+}
+/**
+ * One authority, named so that an effect and a capability can never collide
+ * in the same set: `effect:network`, `capability:http:get:api.example.com`.
+ */
+export interface AuthorityRef {
+    readonly kind: AuthorityKind;
+    readonly name: string;
+}
+export declare function effectRef(effect: KnownEffect): AuthorityRef;
+export declare function capabilityRef(capability: Capability | string): AuthorityRef;
+export declare function formatAuthorityRef(ref: AuthorityRef): string;
+/**
+ * The effects a record's function is trusted with: what it declared, or —
+ * when it declared nothing — what its body was inferred to do.
+ *
+ * This is the rule `propagate` already applies to a callee (a declaration is
+ * believed; an undeclared function contributes its own inferred effects), so
+ * a change here is exactly a change in what the rest of the codebase is
+ * entitled to assume. It is also what makes widening a tag visible: declaring
+ * `network` where `pure` was declared raises the effective set even though
+ * the body did not move.
+ */
+export declare function effectiveEffects(record: AuthorityRecord): readonly KnownEffect[];
+/** The capability half of {@link effectiveEffects}, on the same rule. */
+export declare function effectiveCapabilities(record: AuthorityRecord): readonly string[];
+/**
+ * Every authority a record's function is trusted with, as refs.
+ *
+ * `unknown` is deliberately absent: it is not an authority but a statement
+ * that the analysis is incomplete (DESIGN.md §4.3), and counting it as one
+ * would report an unanalyzable call as a permission. `ambit diff` reports
+ * `unknown` transitions separately, so an unanalyzable range is still never
+ * silently reported as unchanged.
+ */
+export declare function effectiveAuthority(record: AuthorityRecord): readonly AuthorityRef[];
+/** Whether the function holds any authority at all — what makes a *new* symbol worth failing on. */
+export declare function holdsAuthority(record: AuthorityRecord): boolean;

package/dist/core/authority.js

@@ -0,0 +1,50 @@
+import { formatCapability } from "./capability.js";
+export function effectRef(effect) {
+    return { kind: "effect", name: effect };
+}
+export function capabilityRef(capability) {
+    return {
+        kind: "capability",
+        name: typeof capability === "string" ? capability : formatCapability(capability),
+    };
+}
+export function formatAuthorityRef(ref) {
+    return `${ref.kind}:${ref.name}`;
+}
+/**
+ * The effects a record's function is trusted with: what it declared, or —
+ * when it declared nothing — what its body was inferred to do.
+ *
+ * This is the rule `propagate` already applies to a callee (a declaration is
+ * believed; an undeclared function contributes its own inferred effects), so
+ * a change here is exactly a change in what the rest of the codebase is
+ * entitled to assume. It is also what makes widening a tag visible: declaring
+ * `network` where `pure` was declared raises the effective set even though
+ * the body did not move.
+ */
+export function effectiveEffects(record) {
+    return record.effects.declared ?? record.effects.observed;
+}
+/** The capability half of {@link effectiveEffects}, on the same rule. */
+export function effectiveCapabilities(record) {
+    return record.capabilities.declared ?? record.capabilities.required;
+}
+/**
+ * Every authority a record's function is trusted with, as refs.
+ *
+ * `unknown` is deliberately absent: it is not an authority but a statement
+ * that the analysis is incomplete (DESIGN.md §4.3), and counting it as one
+ * would report an unanalyzable call as a permission. `ambit diff` reports
+ * `unknown` transitions separately, so an unanalyzable range is still never
+ * silently reported as unchanged.
+ */
+export function effectiveAuthority(record) {
+    return [
+        ...effectiveEffects(record).map(effectRef),
+        ...effectiveCapabilities(record).map((capability) => capabilityRef(capability)),
+    ];
+}
+/** Whether the function holds any authority at all — what makes a *new* symbol worth failing on. */
+export function holdsAuthority(record) {
+    return effectiveAuthority(record).length > 0;
+}